CVE-2024-0677

Pz-LinkCard <= 2.5.1 - Contributor+ SSRF

Medium · published March 28, 2024

CVSS v3.1
5.1
EPSS
0%
Percentile
17.1
In the wild
Unconfirmed
What it is

The Pz-LinkCard WordPress plugin through 2.5.1 does not prevent users from pinging arbitrary hosts via some of its shortcodes, which could allow high privilege users such as contributors to perform SSRF attacks.

The record
Technical detail
CVSS v3.1
5.1 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00263 · 17.1th percentile
Published
2024-03-28T05:00Z
EPSS history
Timeline
  • 28 MAR 05:00Z
    Pz-LinkCard <= 2.5.1 - Contributor+ SSRF
    cvelistv5